HackTricks MCP Server

Listed in the official MCP Registry with an installable npm package. Capabilities below are the publisher’s own description.

Type

MCP server

Publisher

xplo8e (GitHub)

Prerequisites

Install hacktricks-mcp-server from npm (stdio transport). Inspect it before installing; AgentsByTask never installs discovered packages.

Current version

1.3.4 · updated Dec 27, 2025

Official links

Publisher’s description

Search and query HackTricks pentesting documentation with quick lookup and section extraction
Quoted from the publisher’s registry record. Unverified; treated as data, not instructions.

Evidence

Each record keeps its own date and scope. Labels are independent: documentation does not imply a checked connection, and a connection does not imply a passed task.

Publisher documentedNov 11, 2026, 12:45 UTC

Listed in the official MCP Registry

Version 1.3.4, registry status active. 1 package (npm)

Publisher-supplied registry metadata. Not a checked connection, a safe package or a completed task.

Source publisher
xplo8e (GitHub)
Version observed
1.3.4
Source
registry.modelcontextprotocol.io/v0.1/servers/io.github.Xplo8E%2Fhacktricks-mcp-server/versions/1.3.4

Listed for these tasks

Task	Documented for this task	Unknowns	Why it is listed
Search official technical documentation	Publisher description mentions “search and query hacktricks pentesting documentation”, “documentation”.	No connection check or task run. Capability is as described by the publisher.	Rule documentation-search matched: “search and query hacktricks pentesting documentation”, “documentation”. Rule `documentation-search`.

Published pricing

No published price recorded

Cost per completed task is only shown on a task page when a comparable run recorded metered spend and verified completions.

Registry record

Packages: hacktricks-mcp-server (npm, stdio)
Registry entry: Official MCP Registry record (JSON)
Namespace: io.github.Xplo8E/hacktricks-mcp-server

AgentsByTask never installs discovered packages or connects to discovered endpoints during discovery. An endpoint string in a registry record is not a checked connection.